javaparser:parseFuzzer: Security exception in com.github.javaparser.GeneratedJavaParser.Expression

Project: https://github.com/javaparser/javaparser.git Detailed Report: https://oss-fuzz.com/testcase?key=5145151399657472 Project: javaparser Fuzzing Engine: libFuzzer Fuzz Target: parseFuzzer Job Type: libfuzzerasanjavaparser Platform Id: linux Crash Type: Security exception Crash Address: Crash...

WS-2023-0428

With this notification I would like to inform about a DoS vector in the Ethereum ABI decoder. We have not yet found a way to exploit this with high impact, still the bug could potentially lead to a DoS in server systems. Feel free to ask about an extension of the embargo period. Trail of Bits is...

libavc:svc_dec_fuzzer: Heap-buffer-overflow in isvcd_process_residual_resample_mb

Project: https://android.googlesource.com/platform/external/libavc https://github.com/ittiam-systems/libavc.git Detailed Report: https://oss-fuzz.com/testcase?key=6151544248336384 Project: libavc Fuzzing Engine: afl Fuzz Target: svcdecfuzzer Job Type: aflasanlibavc Platform Id: linux Crash Type:...

libavc:svc_dec_fuzzer: Crash in ih264d_fill_bs1_16x16mb_pslice

Project: https://android.googlesource.com/platform/external/libavc https://github.com/ittiam-systems/libavc.git Detailed Report: https://oss-fuzz.com/testcase?key=4760994878193664 Project: libavc Fuzzing Engine: libFuzzer Fuzz Target: svcdecfuzzer Job Type: libfuzzermsanlibavc Platform Id: linux...

libavc:svc_dec_fuzzer: Crash in ih264d_rep_mv_colz

Project: https://android.googlesource.com/platform/external/libavc https://github.com/ittiam-systems/libavc.git Detailed Report: https://oss-fuzz.com/testcase?key=5809057952563200 Project: libavc Fuzzing Engine: libFuzzer Fuzz Target: svcdecfuzzer Job Type: libfuzzermsanlibavc Platform Id: linux...

Ethereum ABI decoder DoS when parsing ZST

With this notification I would like to inform about a DoS vector in the Ethereum ABI decoder. We have not yet found a way to exploit this with high impact, still the bug could potentially lead to a DoS in server systems. Feel free to ask about an extension of the embargo period. Trail of Bits is...

PT-2023-33060 · Unknown +1 · Ethereum Abi Decoder +1

Name of the Vulnerable Software and Affected Versions: Ethereum ABI decoder affected versions not specified Description: A potential denial-of-service DoS vector exists in the Ethereum ABI decoder due to the specification allowing zero-sized-types ZST. This can cause excessive resource consumptio...

libavc:svc_dec_fuzzer: Heap-buffer-overflow in ih264d_format_convert

Project: https://android.googlesource.com/platform/external/libavc https://github.com/ittiam-systems/libavc.git Detailed Report: https://oss-fuzz.com/testcase?key=4668804936105984 Project: libavc Fuzzing Engine: honggfuzz Fuzz Target: svcdecfuzzer Job Type: honggfuzzasanlibavc Platform Id: linux...

Security Bulletin: Vulnerability in Golang Go affect IBM Cloud Pak System [CVE-2022-41723]

Summary Vulnerability in Golang Go affect IBM Cloud Pak System. Vulnerability Details CVEID:CVE-2022-41723 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by a flaw in the HPACK decoder. By sending a specially-crafted HTTP/2 stream, a remote attacker could exploit this...

The vulnerability of Squid’s chunked decoder allows a hacker to interact directly with the server.

The vulnerability of Squid’s chunked proxy server decoder is related to the way the server interprets fragmented encoding syntax. Exploiting this vulnerability allows a remote attacker to interact directly with the server...

Ubuntu: Security Advisory (USN-6500-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-6500-1 squid vulnerabilities

Joshua Rogers discovered that Squid incorrectly handled validating certain SSL certificates. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 23.04, and Ubuntu 23.10. CVE-2023-46724 Joshua...

ROS-20231115-01

A vulnerability in the Squid proxy server related to the execution of a "buffer overflow" attack, writing up to 2MB of of arbitrary data to the memory heap when Squid is configured to accept HTTP Digest Authentication. Exploitation of the vulnerability could allow an attacker acting remotely to...

The vulnerability of the Golang programming language decoder, related to excessive iteration, allows attackers to trigger a service failure.

The vulnerability of the Golang programming language decoder is related to excessive processing load on the processor during decoding. Exploiting this vulnerability can allow a remote attacker to cause service failures...

The vulnerability of the Golang programming language decoder, related to the distribution of resources without any restrictions or regulations, allows attackers to cause service failures.

The vulnerability of the Golang programming language decoder is related to the decoding of large amounts of compressed data, which consumes excessive memory and processing power. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

Oracle Linux 8 : container-tools:ol8 (ELSA-2023-6939)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-6939 advisory. - rebuild for following CVEs: CVE-2023-25173 CVE-2022-41724 CVE-2022-41725 CVE-2023-24537 CVE-2023-24538 CVE-2023-24534 CVE-2023-24536 CVE-2022-41723...

PT-2023-35601 · Git +1 · Libavc

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow read crash. Technical details about the crash include the functions ih264d sev, ih264d parse fgc, and ih26...

Fedora 38 : podman-tui (2023-e359fd31d2)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-e359fd31d2 advisory. podman-tui v0.12.0 + security fix for CVE-2023-39325 and CVE-2022-41717 and CVE-2022-41723 Tenable has extracted the preceding description block...

Oracle Linux 9 : buildah (ELSA-2023-6473)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-6473 advisory. - rebuild for following CVEs: CVE-2023-25173 CVE-2022-41724 CVE-2022-41725 CVE-2023-24538 CVE-2023-24534 CVE-2023-24536 CVE-2022-41723 CVE-2023-24539...

ROS-20231116-02

Vulnerability in DecodeConfig component of Golang programming language is related to uncontrolled consumption of resources. resources. Exploitation of the vulnerability could allow an attacker to cause a denial of service A vulnerability in the decoder component of the Golang programming language...